CVE-2017-3870 Security feature bypass in Cisco Web Security Appliance
Unauthenticated attackers can bypass URL filtering rules on Cisco WSA appliances configured for email scanning, allowing access to blocked content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3870?
CVE-2017-3870 is a medium-severity vulnerability in Cisco Web Security Appliance, published on 17 Mar 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the URL filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass a configured URL filter rule. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA), both virtual and hardware appliances, that are configured with URL filters for email scanning. More Information: CSCvc69700. Known Affected Releases: 8.5.3-069 9.1.1-074 9.1.2-010.
Weakness: CWE-119
Which versions are affected by CVE-2017-3870?
It affects 1 product.
Products include Cisco Web Security Appliance.
How do I fix CVE-2017-3870?
No fix has been published for CVE-2017-3870 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-3870 being exploited?
There is no known exploitation of CVE-2017-3870 in the wild and no public exploit code.
Other vulnerabilities in Cisco Web Security Appliance
Sources
Also known as GHSA-cx22-cj62-6f44.